IN THE CLAIMS : 



Please substitute the following claims for the same-numbered claims in the application: 

1 . (Currently Amended) A method of performing, by a computerized system, self-diagnosis 
by_automatically identifying anomalous situations during operations of [[a]] said computerized 
system, said method comprising: 

recording , by said computerized system, actions performed by said computerized system 
during features of normal operations of said computerized system , said actions being stored in a 
history first file as features of said normal operations : 

automatically creating , by said computerized system, [[a]] models for each of said 
features of said normal operations in said history file , wherein said each model comprises a 
mathematical statement indicating what that predicts a value of a corresponding feature based on 
equals in terms of relationships with all other features; 

calculating , by said computerized system, anomaly scores of said features of said normal 
operations and storing said anomaly scores in a trained second file, wherein said anomaly scores 
are predictive of whether each of said features will be normal according to previously defined 
standards when one or more of the other features are abnormal according to previously defined 
standards; 

establishing , by said computerized system, a threshold to evaluate whether events in live 
operations of said computerized system are anomalies as compared to said normal operations; 
automatically identifying , by said computerized system, anomalous events in said live 
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operations based on said anomaly scores and on said threshold; 

reporting , by said computerized system, said anomalous events; and 
periodically repeating , by said computerized system, said calculating. 

2. (Currently Amended) The method in claim 1, all the limitations of which are incorporated 
herein by reference, wherein said creating comprises: 

establishing relationships that exist between each of said features of said normal 
operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises said model 
for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

3. (Canceled). 

4. (Currently Amended) The method in claim 2, all the limitations of which are incorporated 
herein by reference, wherein said normal operations comprise said features in said history first 
file at the time said models are created. 
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5. (Currently Amended) The method in claim 1, all the limitations of which are incorporated 
herein by reference, wherein said calculating comprises: 

predicting a likelihood that said each feature will be normal when one or more of the 
other features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained second file of a plurality of anomaly scores for each of said 
features. 

6. (Currently Amended) The method in claim 5, all the limitations of which are incorporated 
herein by reference, wherein said trained file provides one anomaly score for each of said 
features for each of a plurality of different possible abnormalities. 

7. (Currently Amended) The method in claim 5, all the limitations of which are incorporated 
herein by reference, wherein said automatically identifying comprises: 

determining values of features for a given operation of said computerized system; 

referring to said trained second file to retrieve an anomaly score for each of said features 
of said given operation; 

comparing said anomaly score for each of said features of said given operation with said 
threshold to determine whether each anomaly score exceeds said threshold. 

8. (Currently Amended) A method of performing, by a computerized system, self-diagnosis 
by_automatically identifying anomalous situations during operations of [[a]] said computerized 
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system, said method comprising: 

recording , by said computerized system, actions performed by said computerized system 
during features of normal operations of said computerized system , said actions being stored in a 
history first file as features of said normal operations ; 

automatically creating , by said computerized system, [[a]] models for each of said 
features of said normal operations in said history first file, wherein each said-model comprises a 
mathematical statement indicating what that predicts a value of a corresponding feature based on 
equals in terms of relationships with all other features; 

calculating , by said computerized system, anomaly scores of said features of said normal 
operations and storing said anomaly scores in a trained second file, wherein said anomaly scores 
are predictive of whether each of said features will be normal according to previously defined 
standards when one or more of the other features are abnormal according to previously defined 
standards; 

establishing , by said computerized system, a threshold to evaluate whether events in live 
operations of said computerized system are anomalies as compared to said normal operations; 

automatically identifying , by said computerized system, anomalous events in said live 
operations based on said anomaly scores and on said threshold; 

reporting , by said computerized system, said anomalous events; and 

periodically repeating , by said computerized system, said calculating; 

wherein said creating of said model for each of said features comprises: 

establishing relationships that exist between each of said features for said normal 

operations; 



10/658,623 



5 



selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said 
labeled feature to create a solution for said labeled feature, wherein said solution comprises said 
model for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

9. (Canceled). 

10. (Currently Amended) The method in claim 8, all the limitations of which are incorporated 
herein by reference, wherein said normal operations comprise said features in said history first 
file at the time said models are created. 

1 1 . (Currently Amended) The method in claim 8, all the limitations of which are incorporated 
herein by reference, wherein said calculating comprises: 

predicting a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained second file of a plurality of anomaly scores for each of said 
features. 
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12. (Currently Amended) The method in claim 1 1 , all the limitations of which are 
incorporated herein by reference, wherein said trained second file provides one anomaly score 
for each of said features for each of a plurality of different possible abnormalities. 

13. (Currently Amended) The method in claim 11, all the limitations of which are 
incorporated herein by reference, wherein said automatically identifying comprises: 

determining values of features for a given operation of said computerized system; 

referring to said trained second file to retrieve an anomaly score for each of said features 
of said given operation; 

comparing said anomaly score for each of said features of said given operation with said 
threshold to determine whether each anomaly score exceeds said threshold. 

14. (Currently Amended) A method of performing, by a computerized system, self-diagnosis 
by automatically identifying anomalous situations during operations of [[a]] said computerized 
system, said method comprising: 

recording , by said computerized system, actions performed by said computerized system 
during features of normal operations of said computerized system , said actions being stored in a 
history first file as features of said normal operations ; 

automatically creating , by said computerized system, [[a]] models for each of said 
features of said normal operations in said history first file, wherein said each model comprises a 
mathematical statement indicating what that predicts a value of a corresponding feature based on 
equals in terms of relationships with all other features; 
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calculating , by said computerized system, anomaly scores of said features of said normal 
operations and storing said anomaly scores in a trained second file, wherein said anomaly scores 
are predictive of whether each of said features will be normal according to previously defined 
standards when one or more of the other features are abnormal according to previously defined 
standards; 

establishing , by said computerized system, a threshold to evaluate whether events in live 
operations of said computerized system are anomalies as compared to said normal operations; 

automatically identifying , by said computerized system, anomalous events in said live 
operations based on said anomaly scores and on said threshold; 

reporting , by said computerized system, said anomalous events; and 

periodically repeating , by said computerized system, said calculating; 

wherein said calculating comprises: 

predicting a likelihood that each feature will be normal when one or more of the 
other features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being 
normal and abnormal to produce said trained second file of a plurality of anomaly scores for each 
of said features. 

15. (Currently Amended) The method in claim 14, all the limitations of which are 
incorporated herein by reference, wherein said creating comprises: 

establishing relationships that exist between each of said features for said normal 
operations; 
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selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises said model 
for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

16. (Canceled). 

17. (Currently Amended) The method in claim 15, all the limitations of which are 
incorporated herein by reference, wherein said normal operations comprise said features in said 
first history file at the time said models are created. 

18. (Currently Amended) The method in claim 14, all the limitations of which are 
incorporated herein by reference, wherein said trained second file provides a one anomaly score 
for each of said features for each of a plurality of different possible abnormalities. 

19. (Currently Amended) The method in claim 14, all the limitations of which are 
incorporated herein by reference, wherein said automatically identifying comprises: 

determining values of features for a given operation of said computerized system; 
referring to said trained second file to retrieve an anomaly score for each of said features 
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of said given operation; 

comparing said anomaly score for each of said features of said given operation with said 
threshold to determine whether each anomaly score exceeds said threshold. 

20. (Currently Amended) A program storage device readable by machine, tangibly 
embodying a program of instructions executable by the machine to perform a method of 
automatically identifying anomalous situations during operations of a computerized system, said 
method comprising: 

recording actions performed by said computerized system during features of normal 
operations of said computerized system , said actions being stored in a history first file as features 
of said normal operations ; 

automatically creating [[a]] models for said each of said features of said normal 
operations in said first history file, wherein said each model comprises a mathematical statement 
indicating what that predicts a value of a corresponding feature based on equals in terms of 
relationships with all other features; 

calculating anomaly scores of said features of said normal operations and storing said 
anomaly scores in a trained second file, wherein said anomaly scores are predictive of whether 
each of said features will be normal according to previously defined standards when one or more 
of the other features are abnormal according to previously defined standards; 

establishing a threshold to evaluate whether events in live operations of said 
computerized system are anomalies as compared to said normal operations; 

automatically identifying anomalous events in said live operations based on said anomaly 
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scores and on said threshold; 

reporting said anomalous events; and 
periodically repeating said calculating. 



21. (Currently Amended) The program storage device in claim 20, all the limitations of 
which are incorporated herein by reference, wherein creating comprises: 

establishing relationships that exist between each of said features for said normal system 
operations; 

selecting a labeled feature from said features; 

mathematically rearranging said relationships from the point of view of said labeled 
feature to create a solution for said labeled feature, wherein said solution comprises said model 
for said labeled feature; 

selecting different features as said labeled feature and repeating said process of 
mathematically rearranging said relationships to produce solutions from the point of view of 
each remaining feature as models for the remaining features. 

22. (Canceled). 

23. (Currently Amended) The program storage device in claim 21, all the limitations of 
which are incorporated herein by reference, wherein said normal operations comprise said 
features in said history first file at the time said models are created. 
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24. (Currently Amended) The program storage device in claim 20, all the limitations of 
which are incorporated herein by reference, wherein said calculating further comprises: 

predicting a likelihood that each feature will be normal when one or more of the other 
features are abnormal, using said model of each of said features; 

repeating said predicting using different presumptions about other features being normal 
and abnormal to produce said trained second file of a plurality of anomaly scores for each of said 
features. 

25. (Currently Amended) The program storage device in claim 24, all the limitations of 
which are incorporated herein by reference, wherein said trained second file provides one 
anomaly score for each of said features for each of a plurality of different possible abnormalities. 

26. (Currently Amended) The program storage device in claim 24, all the limitations of 
which are incorporated herein by reference, wherein said automatically identifying comprises: 

determining values of features for a given operation of said computerized system; 

referring to said trained second file to retrieve an anomaly score for each of said features 
of said given operation; 

comparing said anomaly score for each of said features of said given operation with said 
threshold to determine whether each anomaly score exceeds said threshold. 
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